{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/cloudera/main/json-schema/cloudera-create-azure-environment-request-schema.json",
  "title": "CreateAzureEnvironmentRequest",
  "description": "Request object for a create Azure environment request.",
  "x-generated": "2026-10-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudera-environments2-api-openapi.yml#/components/schemas/CreateAzureEnvironmentRequest",
  "type": "object",
  "required": [
    "environmentName",
    "credentialName",
    "region",
    "publicKey",
    "securityAccess",
    "usePublicIp",
    "logStorage",
    "existingNetworkParams"
  ],
  "properties": {
    "environmentName": {
      "type": "string",
      "description": "The name of the environment. Must contain only lowercase letters, numbers and hyphens."
    },
    "credentialName": {
      "type": "string",
      "description": "Name of the credential to use for the environment."
    },
    "region": {
      "type": "string",
      "description": "The region of the environment."
    },
    "publicKey": {
      "type": "string",
      "description": "Public SSH key string. The associated private key can be used to get root-level access to the Data Lake instance and Data Hub cluster instances."
    },
    "securityAccess": {
      "description": "Security control for FreeIPA and Data Lake deployment.",
      "$ref": "#/$defs/SecurityAccessRequest"
    },
    "usePublicIp": {
      "type": "boolean",
      "description": "Whether to associate public ip's to the resources within the network."
    },
    "logStorage": {
      "description": "Azure storage configuration for cluster and audit logs.",
      "$ref": "#/$defs/AzureLogStorageRequest"
    },
    "existingNetworkParams": {
      "description": "Parameters needed to use an existing VNet and Subnets.",
      "$ref": "#/$defs/ExistingAzureNetworkRequest"
    },
    "description": {
      "type": "string",
      "description": "An description of the environment."
    },
    "enableTunnel": {
      "type": "boolean",
      "default": true,
      "description": "Whether to enable SSH tunneling for the environment."
    },
    "workloadAnalytics": {
      "type": "boolean",
      "description": "When this is enabled, diagnostic information about job and query execution is sent to Workload Manager for Data Hub clusters created within this environment."
    },
    "freeIpa": {
      "$ref": "#/$defs/AzureFreeIpaCreationRequest",
      "description": "The FreeIPA creation request for the environment"
    },
    "enableComputeCluster": {
      "description": "Enable compute clusters for environment",
      "type": "boolean"
    },
    "computeClusterConfiguration": {
      "description": "The Externalized k8s configuration create request for the environment.",
      "$ref": "#/$defs/AzureComputeClusterConfigurationRequest"
    },
    "image": {
      "$ref": "#/$defs/FreeIpaImageRequest",
      "description": "The FreeIPA image request for the environment"
    },
    "tags": {
      "type": "array",
      "description": "Tags associated with the resources.",
      "items": {
        "$ref": "#/$defs/TagRequest"
      }
    },
    "proxyConfigName": {
      "type": "string",
      "description": "Name of the proxy config to use for the environment."
    },
    "resourceGroupName": {
      "type": "string",
      "description": "Name of an existing Azure resource group to be used for the environment. If it is not specified then new resource groups will be generated."
    },
    "createPrivateEndpoints": {
      "type": "boolean",
      "description": "When this is enabled, then Azure Postgres will be configured with Private Endpoint and a Private DNS Zone. When this is disabled, then Azure Service Endpoints will be created. The default value is disabled."
    },
    "endpointAccessGatewayScheme": {
      "type": "string",
      "description": "The scheme for the endpoint gateway. PUBLIC creates an external endpoint that can be accessed over the Internet. Defaults to PRIVATE which restricts the traffic to be internal to the VNet.",
      "enum": [
        "PUBLIC",
        "PRIVATE"
      ]
    },
    "endpointAccessGatewaySubnetIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The subnets to use for endpoint access gateway."
    },
    "encryptionAtHost": {
      "type": "boolean",
      "description": "When this is enabled, we will provision resources with host encrypted true flag."
    },
    "encryptionUserManagedIdentity": {
      "type": "string",
      "description": "User managed identity for encryption."
    },
    "encryptionKeyUrl": {
      "type": "string",
      "description": "URL of the key which will be used to encrypt the Azure Managed Disks, if entitlement has been granted.",
      "x-no-paramfile": true
    },
    "encryptionKeyResourceGroupName": {
      "type": "string",
      "description": "Name of the existing Azure resource group hosting the Azure Key Vault containing customer managed key which will be used to encrypt the Azure Managed Disks. It is required only when the entitlement is granted and the resource group of the key vault is different from the resource group in which the environment is to be created. Omitting it implies that, the key vault containing the encryption key is present in the same resource group where the environment would be created."
    },
    "enableOutboundLoadBalancer": {
      "type": "boolean",
      "description": "Whether or not outbound load balancers should be created for Azure environments. The default behavior is to not create the outbound load balancer."
    },
    "availabilityZones": {
      "description": "The zones of the environment in the given region.",
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "flexibleServerSubnetIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The subnets delegated for Flexible Server database. Accepts either the name or the full resource id."
    },
    "dataServices": {
      "description": "Data Services parameters of the environment.",
      "$ref": "#/$defs/DataServicesRequest"
    },
    "customDockerRegistry": {
      "description": "Configures the desired custom docker registry for data services.",
      "$ref": "#/$defs/CustomDockerRegistryRequest"
    },
    "environmentType": {
      "description": "Environment type which can be hybrid or public cloud.",
      "type": "string",
      "enum": [
        "PUBLIC_CLOUD",
        "HYBRID"
      ]
    }
  },
  "$defs": {
    "AzureComputeClusterConfigurationRequest": {
      "description": "Request object for creating Externalized compute cluster for the environment.",
      "type": "object",
      "properties": {
        "privateCluster": {
          "type": "boolean",
          "description": "If true, creates private cluster"
        },
        "kubeApiAuthorizedIpRanges": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Kubernetes API authorized IP ranges in CIDR notation. Mutually exclusive with privateCluster."
        },
        "outboundType": {
          "type": "string",
          "enum": [
            "udr"
          ],
          "description": "Customize cluster egress with defined outbound type in Azure Kubernetes Service."
        },
        "workerNodeSubnets": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Specify subnets for Kubernetes Worker Nodes"
        }
      }
    },
    "AzureDataServicesParametersRequest": {
      "description": "Azure-specific Data Service parameters request.",
      "type": "object",
      "required": [
        "sharedManagedIdentity"
      ],
      "properties": {
        "sharedManagedIdentity": {
          "type": "string",
          "description": "User-assigned managed identity used by the AKS control plane."
        },
        "aksPrivateDnsZoneId": {
          "type": "string",
          "description": "The full Azure resource ID of an existing Private DNS zone used for the AKS."
        }
      }
    },
    "AzureFreeIpaCreationRequest": {
      "description": "Request object for creating FreeIPA in the environment.",
      "type": "object",
      "properties": {
        "instanceCountByGroup": {
          "type": "integer",
          "format": "int32",
          "description": "The number of FreeIPA instances to create per group when creating FreeIPA in the environment"
        },
        "recipes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The recipes for the FreeIPA cluster."
        },
        "instanceType": {
          "type": "string",
          "description": "Custom instance type of FreeIPA instances."
        },
        "multiAz": {
          "type": "boolean",
          "default": false,
          "description": "Flag that enables deployment of the FreeIPA in a multi-availability zone."
        }
      }
    },
    "AzureLogStorageRequest": {
      "type": "object",
      "description": "Azure storage configuration for cluster and audit logs.",
      "required": [
        "storageLocationBase",
        "managedIdentity"
      ],
      "properties": {
        "storageLocationBase": {
          "type": "string",
          "description": "The storage location to use. The location has to be in the following format abfs://filesystem@storage-account-name.dfs.core.windows.net. The filesystem must already exist and the storage account must be StorageV2."
        },
        "managedIdentity": {
          "type": "string",
          "description": "The managed identity associated with the logger. This identity should have Storage Blob Data Contributor role on the given storage account."
        },
        "backupStorageLocationBase": {
          "type": "string",
          "description": "The storage location to use. The location has to be in the following format abfs://filesystem@storage-account-name.dfs.core.windows.net. The filesystem must already exist and the storage account must be StorageV2."
        }
      }
    },
    "CustomDockerRegistryRequest": {
      "description": "The desired custom docker registry for data services to be used.",
      "type": "object",
      "required": [
        "crn"
      ],
      "properties": {
        "crn": {
          "type": "string",
          "description": "The CRN of the desired custom docker registry for data services to be used."
        }
      }
    },
    "DataServicesRequest": {
      "type": "object",
      "description": "Data Services parameters request of the environment.",
      "properties": {
        "azure": {
          "description": "Azure-specific Data Service parameters request.",
          "$ref": "#/$defs/AzureDataServicesParametersRequest"
        }
      }
    },
    "ExistingAzureNetworkRequest": {
      "type": "object",
      "description": "Request object for creating an Azure environment using existing VNet and subnets.",
      "required": [
        "networkId",
        "resourceGroupName",
        "subnetIds"
      ],
      "properties": {
        "networkId": {
          "type": "string",
          "description": "The id of the Azure VNet."
        },
        "resourceGroupName": {
          "type": "string",
          "description": "The name of the resource group associated with the VNet."
        },
        "subnetIds": {
          "type": "array",
          "description": "One or more subnet ids within the VNet.",
          "uniqueItems": true,
          "items": {
            "type": "string"
          }
        },
        "databasePrivateDnsZoneId": {
          "type": "string",
          "description": "The full Azure resource ID of the existing Private DNS Zone used for Flexible Server and Single Server Databases."
        },
        "aksPrivateDnsZoneId": {
          "type": "string",
          "description": "The full Azure resource ID of an existing Private DNS zone used for the AKS."
        }
      }
    },
    "FreeIpaImageRequest": {
      "description": "Request object for FreeIPA image.",
      "type": "object",
      "properties": {
        "catalog": {
          "type": "string",
          "description": "Image catalog to use for FreeIPA image selection.",
          "x-no-paramfile": true
        },
        "id": {
          "type": "string",
          "description": "Image ID to use for creating FreeIPA instances."
        },
        "os": {
          "type": "string",
          "description": "The OS to use for creating FreeIPA instances."
        }
      }
    },
    "SecurityAccessRequest": {
      "type": "object",
      "description": "Security control configuration for FreeIPA and Datalake deployment. Choosing a CIDR will automatically create security groups. Alternatively existing security groups can be specified.",
      "properties": {
        "cidr": {
          "type": "string",
          "description": "CIDR range which is allowed for inbound traffic. Either IPv4 or IPv6 is allowed."
        },
        "securityGroupIdForKnox": {
          "type": "string",
          "description": "Security group where Knox-enabled hosts are placed. Mutually exclusive with cidr."
        },
        "defaultSecurityGroupId": {
          "type": "string",
          "description": "Security group where all other hosts are placed. Mutually exclusive with cidr."
        },
        "securityGroupIDsForKnox": {
          "type": "array",
          "description": "Security group IDs where Knox-enabled hosts are placed. Mutually exclusive with CIDR.",
          "uniqueItems": true,
          "items": {
            "type": "string"
          }
        },
        "defaultSecurityGroupIDs": {
          "type": "array",
          "description": "Security group IDs where all other hosts are placed. Mutually exclusive with CIDR.",
          "uniqueItems": true,
          "items": {
            "type": "string"
          }
        }
      }
    },
    "TagRequest": {
      "description": "A label that can be attached to some resources.",
      "type": "object",
      "required": [
        "key",
        "value"
      ],
      "properties": {
        "key": {
          "type": "string",
          "description": "The tag's name."
        },
        "value": {
          "type": "string",
          "description": "The associated value of the tag."
        }
      }
    }
  }
}